User Role Editor

Item: User Role Editor
Rating: 4.5
Author: Fast WordPress

by Vladimir Garagulya

Edits WordPress capabilities per role so contributors get exactly the access they need and nothing more.

4.5288 WordPress.org reviewsMembershipsFreemium

Get User Role Editor Test your site speed

This link may earn us a commission. It never changes our rating.

What User Role Editor does

Edits WordPress capabilities per role so contributors get exactly the access they need and nothing more.

It sits in the memberships part of a WordPress stack and is sold by Vladimir Garagulya on a freemium basis. We recommend it in our memberships guides because it does that one job well without asking you to rebuild the rest of the site around it.

Every plugin adds work to a page request, so treat this as a decision with a cost. Record a speed test before you install it and run the same test afterwards, on the same page, so you know exactly what it charged you.

Real user ratings

Score

4.5/5

Reviews

288

Active installs

700,000+

Downloads

22.6M

Latest version

4.66.1

Last updated

2026-08-25

These figures come straight from the public WordPress.org plugin directory API for version 4.66.1, not from us. Check them yourself on the WordPress.org listing. Our own editorial score is 4.5/5.

Where User Role Editor ranks elsewhere

User Role Editor does not appear in the published "best of" lists we track from WPBeginner, TechRadar, Kinsta, Themeisle and similar sites. That is not a mark against it - those roundups are short and skew towards the biggest names.

What changed in the latest version

v4.66.1Latest release

Fix: URE_Assign_Role::$lib property was changed to protected.
Fix: URE_Uninstall::delete_options() private function changed to protected.
Fix: URE_Uninstall::init_options_list() referenced 'ure_task_queue', which never matched URE_Task_Queue::OPTION_NAME ('ure_tasks_queue'), so that option was never deleted on uninstall.
Fix: URE_Core::define_files() - class URE_Uninstall was not added correctly, null was written instead of class name.
Fix: activating Pro while free was already active caused a fatal "Cannot redeclare ure_log_error()" error; the function declaration is now guarded with function_exists().
Fix: activating this plugin while the paired Pro plugin was already active silently left both active instead of deactivating the paired one, because the register_activation_hook() call never ran in that request; it's now registered as a ...

v4.66

Update: Marked as compatible with WordPress 7.1
Required PHP version increased up to 7.4
Required WordPress version increased up to 4.6
Update: Plugin loading code is enhanced.
Update: Plugin does not use self-defined PHP global constants. Needed data moved inside classes.
Update: URE_Admin_Notice class output was escaped with esc_attr(), wp_kses_post() functions.
Security Fix: SQL queries in URE_Editor::direct_network_roles_update() and leave_roles_for_blog() are passed to $wpdb->prepare() with real %s placeholders.
Security Fix: URE_Editor::get_caps_columns_quant() now requires a valid nonce before writing a display-preference transient from $_POST, closing a minor CSRF gap.

v4.65

Update: Marked as compatible with WordPress 7.0
Update: Pages markup are modified to correspond WordPress 7.0 CSS changes.
Update: "defined('ABSPATH')" guard was added to all PHP files to exclude PHP files direct execution.
Update: sanitize_text_field(), sanitize_key(), sanitize_url() functions are used to secure user input before processing.
Update: _nonce field checking was added before data update in addition to test made already on the higher level.

Release notes are the developer's own words, published on WordPress.org. Read the full changelog

Pros and cons

Granular capability control without custom code
A free tier you can trial before paying
Actively maintained and used on production sites we test

Careless edits can lock out administrators
The features most sites need sit in the paid tier

How to use it

1Map out your levels and what each one unlocks before configuring anything.
2Create the levels, then apply access rules to content rather than per post.
3Test signup, renewal and cancellation as a real member would.
4Exclude account and members-only pages from caching.
5Set up dunning emails for failed recurring payments.

How it compares

Other memberships plugins we recommend, with their rating and pricing model.

Plugin	Our rating	WordPress.org	Pricing	Best for
User Role Editor	4.5	4.5 (288)	Freemium	Granular capability control without custom code
Leaky Paywall	4.3	4.2 (35)	Premium	Metered access built for publishers
MemberPress	4.6	n/a	Premium	Cleanest access rules of any option
Members	4.9	4.9 (1,275)	Free	Content restriction and role editing in one free plugin
Paid Memberships Pro	4.5	n/a	Freemium	Free core with real functionality
ProfilePress	4.4	n/a	Freemium	Front-end user management done well